UniFaaS: A Unikernel-Based Serverless Operating System

Serverless computing, also know as Function as a Service (FaaS), is an emerging
programming paradigm providing significant benefits for both the tenant (i.e.
the application developer) and the provider in terms of costs reduction,
data centre efficiency, scalability, etc. With its truly on-demand resource
consumption and pricing model, as well as the fact that the tenant is relieved
from any infrastructure management effort, serverless has the potential of
fully delivering on the core promises of cloud computing, and experts agree
that its usage will skyrocket in the years to come.

Serverless computing is made possible by two crucial concepts implemented by
the systems software assuring the execution of functions and running in the
provider's infrastructure: (1) the isolation of the data and performance of
mutually untrusting functions running on the same physical host and (2) the
lightweightness of the systems software supporting the execution of functions,
i.e. the potential for low memory and disk footprint as well as fast invocation
times for this software. The current serverless infrastructures are suboptimal
regarding both concepts as they use a combination of virtual machines (well
isolated but heavyweight) and containers (lightweight but presenting some
serious isolation concerns).

The unikernel is a new Operating System (OS) model in which an application is
executed with a very small custom operating system layer as minimal virtual
machine in the cloud. In effect, unikernels combine the strong isolation of
virtual machines with a container-like level of lightweightness. These
characteristics make that the unikernel is a uniquely fit candidate to run as
serverless infrastructure systems software.

We propose to explore the use of the unikernel OS model as the primary unit of
function execution in a serverless computing infrastructure. We note that
although it presents some fundamental benefits, the unikernel model needs to
evolve to perfectly fit the serverless domain. The principal issue is the lack
of support for important features, namely intra-unikernel isolation and
multi-processing. These shortcomings are not simply due to missing
implementations, but rather derive from fundamental design principles of the
unikernel OS model.

Hence, we propose to design and implement UniFaaS as an evolution of the
unikernel OS model tailored for serverless computing. UniFaaS aims to support
the aforementioned lacking features, while maintaining the isolation and
lightweightness benefits that unikernels naturally offer. UniFaaS will be built
on top of an existing unikernel, namely OSv. The design and development effort
will be made along 3 main avenues: (1) new functionalities development, in
particular multi-process support using threads as well as further
specialisation the towards serverless computing; (2) security enhancements, in
particular the introduction of low-overhead intra-unikernel isolation using
modern hardware technologies; and (3) lightweightness optimisations to further
reduce per-unikernels and per-function memory/disk footprints as well as
boot/invocation time through various methods, in order to increase per-host
function density.

Once UniFaaS is built, we will evaluate its security/isolation,
lightweightness, and performance, by comparing it to traditional serverless
deployments that use virtual machines and containers. Regarding security, we
note that the current metrics to assess isolation (such as counting the number
of lines of code of a software) are rather imprecise and we will develop a
novel method based on the amount of trusted code (guest kernel and/or
hypervisor/host) that can be reached from an untrusted component (application
code, network, etc.).